The BoKS Server Agent contains a flaw in its adjoin utility that produces machine‑account passwords with lower-than‑expected entropy. A predictable password generation algorithm can let a threat actor infer a generated password if the approximate time of creation is known. Compromised machine‑account passwords could be used to authenticate against Active Directory or local systems, potentially giving an attacker elevated privileges or allowing lateral movement across a network.

Fortra’s Core Privileged Access Manager (BoKS) Server Agent is affected in any release older than 8.1.0.29 for the 8.x line or 9.0.0.5 for the 9.x line. Users deploying those versions should assess whether machine‑account passwords were generated during Active Directory join or auto‑renewal before the vulnerability was addressed.

The CVSS score of 4.8 indicates moderate severity. Although the EPSS score is not available and the vulnerability is not in the KEV catalog, the flaw can still be leveraged by an adversary who can approximate the time a password was issued, such as a user or script that forces an adjoin or renewal operation. Because the weakness is limited to password entropy, the primary risk is credential compromise rather than remote code execution; however, gaining a valid machine account can lead to significant privilege escalation within the domain.